CVE-2026-19306: Langflow Path Traversal Vulnerability

CVE-2026-19306 Overview

CVE-2026-19306 is a path traversal vulnerability [CWE-22] in IBM Langflow OSS versions 1.0.0 through 1.11.2. An authenticated attacker can read arbitrary files from the server filesystem by supplying absolute paths or traversal sequences in the files parameter of a build request. The file contents are embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. Exposed assets include the application secret_key, JSON Web Token (JWT) signing keys, the application database, /proc/self/environ, and other tenants' upload directories. The flaw bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which is enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.

Critical Impact
Authenticated attackers can exfiltrate server secrets, JWT signing keys, application databases, and cross-tenant upload data through the LLM prompt channel.

Affected Products

IBM Langflow OSS versions 1.0.0 through 1.11.2
Deployments on Linux
Deployments on Apple macOS and Microsoft Windows

Discovery Timeline

2026-09-04 - CVE-2026-19306 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19306

Vulnerability Analysis

The vulnerability resides in the Chat Input to Message attachment pipeline of IBM Langflow OSS. When a client submits an authenticated build request, the files parameter accepts paths that identify user-uploaded attachments. The pipeline reads those files from disk and inlines their contents as text attachments in the language model prompt. The read operation trusts the caller-supplied path without normalization or containment checks.

An attacker with valid credentials can supply absolute paths such as /etc/passwd or traversal sequences such as ../../ to escape the intended upload directory. The pipeline then reads the referenced file and forwards its contents to the configured model endpoint, where the attacker retrieves the data as part of the model response. This turns the LLM channel into a covert exfiltration path for sensitive server-side files.

Root Cause

The root cause is missing path canonicalization and access control in the Chat Input attachment handler. Langflow enforces the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true setting for other file-reading components, but the attachment pipeline does not consult this containment boundary. The handler resolves user-supplied paths directly against the server filesystem with the privileges of the Langflow process.

Attack Vector

Exploitation requires network access to the Langflow API and a valid authenticated session. The attacker crafts a build request that specifies target files in the files parameter using absolute paths or traversal sequences. High-value targets include the Langflow secret_key, JWT signing keys, the SQLite or PostgreSQL application database, /proc/self/environ, and upload directories belonging to other tenants. The server reads each file, embeds the contents in the prompt sent to the language model, and the attacker recovers the material from the model output. No user interaction is required, and the scope changes because a low-privileged tenant can access data owned by other tenants and the host operating system.

Detection Methods for CVE-2026-19306

Indicators of Compromise

Authenticated build requests where the files parameter contains absolute paths such as /etc/, /proc/, or /var/, or traversal sequences such as ../.
Outbound LLM API traffic with unusually large prompt payloads that correlate in time with anomalous build requests.
Access log entries showing Langflow reading files outside the configured uploads directory.

Detection Strategies

Inspect application logs for build requests whose attachment paths do not resolve inside the tenant's upload directory.
Correlate authentication events with build activity to identify sessions that enumerate filesystem paths across multiple requests.
Monitor egress to configured model endpoints for prompt sizes and content patterns consistent with file exfiltration, including base64 blobs and configuration file signatures.

Monitoring Recommendations

Enable verbose audit logging on the Langflow API and forward it to a centralized analytics platform.
Alert on any read access to sensitive paths such as secret_key, .env, JWT key files, and the application database file.
Track per-tenant file access baselines and flag cross-tenant directory reads.

How to Mitigate CVE-2026-19306

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release identified in the vendor advisory as soon as it becomes available.
Rotate the Langflow secret_key, JWT signing keys, database credentials, and any secrets exposed through the environment.
Audit build request logs since deployment for files parameter values containing absolute paths or .. sequences.
Review outbound traffic to LLM endpoints for prior exfiltration and treat any suspect tenants as compromised.

Patch Information

Refer to the IBM Support advisory for CVE-2026-19306 for fixed version details and upgrade guidance. Apply the patched release across all Langflow instances, including development and staging environments that share credentials or data with production.

Workarounds

Restrict network access to the Langflow API using an allowlist of trusted client IP ranges.
Run Langflow under a dedicated low-privileged operating system account with filesystem access limited to the uploads directory.
Deploy Langflow inside a container with read-only bind mounts and no access to host secrets, /proc, or other tenants' data.
Place an authenticating reverse proxy in front of Langflow and inspect the files parameter to block absolute paths and traversal sequences.

bash

# Configuration example: containment hardening for Langflow deployments
export LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true
# Run the container with a read-only root filesystem and a scoped uploads volume
docker run --read-only \
  --user 1000:1000 \
  --tmpfs /tmp \
  -v /srv/langflow/uploads:/app/uploads:rw \
  -e LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true \
  langflowai/langflow:latest